I have an apache running under user apache with a lot of permissions (rw to multiple directories). Now I want to let some users upload programs/scripts via webform and execute them, with php function exec() in file upload php page. However, I don't want those programs to be able to write anything to hard drive. It seems program sudo might do what I need, but I don't know how to use it.
Shorter: how to run programs and scripts in readonly mode under powerful user?
In case it matters, my system is Centos 6.


You're right, sudo to a user with read but not write permission will run a command in a way that only has write access to files you give it permission for.

sudo -u some_user cmdname

Running arbitrary user-uploaded programs requires extreme security precautions. Local-root exploits are unfortunately not uncommon in Linux. Letting users run programs they upload without some kind of jail / containment, if not a virtual machine, is unwise.

You should build your system so it's still at least probably secure even if the uploaded program takes advantage of an unpatched root exploit, to elevate its privileges from nobody to root.

  • What if I change the rules: users may upload lots of programs, each of them being put to its own directory by apache, and then run there having access only to this folder. How do I do that? Creating a new user for every uploaded app doesn't seem nice, or is it ok? – Serge Seredenko Aug 20 '15 at 0:53
  • @SergeSeredenko: I missed that you want this for user-uploaded programs. If you can possibly avoid needing to run arbitrary user-uploaded binaries / scripts, then avoid it. It's a lot of work to keep a system secure for this use-case. And even then, there will always be 0-day exploits that are known for at least a short window before there's a patch available. – Peter Cordes Aug 20 '15 at 1:06
  • I'd use at least a chroot for each user. Look into whatever web hosters use for giving ssh access to users. – Peter Cordes Aug 20 '15 at 1:07
  • Thank you, I understand that. I am not afraid of exploiting, its not the case. Let's say those "some users" are my friends. I am only afraid of somebody accidentally breaking something. So, is running adduser u321 by apache (therefore creating really a lot of users) alright approach for restricting each uploaded app to its directory? Isn't there a more "local" way to do this? – Serge Seredenko Aug 20 '15 at 1:23
  • @SergeSeredenko: ok yeah, if this isn't something where anyone with an email addr can sign up and run code on your server, then sure. The easiest way to design this is probably going to be to get a Unix account created for each user. Apache already has support for users with their own directories (http://example.org/~username/ -> /home/username/public_html/). I forget, but I think Apache already runs CGI scripts in user homedirs under the user's UID (rather than root or nobody). Building your design on top of that means less of your own code that could have security bugs. – Peter Cordes Aug 20 '15 at 1:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.